ProFTPD is a ftp server written for use on Unix and Unix-a-like operating systems, there is no support for native use under Microsoft Windows.

The TLS protocol allows applications to communicate across a network in a way designed to prevent eavesdropping, tampering, and message forgery. TLS provides endpoint authentication and communications privacy over the Internet using cryptography. Typically, only the server is authenticated (i.e., its identity is ensured) while the client remains unauthenticated.

FTP is a very insecure protocol because all passwords and all data are transferred in clear text. By using TLS, the whole communication can be encrypted, thus making FTP much more secure. This article explains how to set up ProFTPd with TLS on a Debian Etch server.

Install ProFTPd And OpenSSL

#apt-get install proftpd openssl

You will be asked a question:

Run proftpd from inetd or standalone?

This will complete the installation.

Configuring proftpd

Now you need to open /etc/proftpd/proftpd.conf and change UseIPv6 from on to off; otherwise you'll get a warning like this when you start ProFTPd

#vi /etc/proftpd/proftpd.conf

UseIPv6 off

For security reasons you can add the following lines to /etc/proftpd.conf

DefaultRoot ~
IdentLookups off
ServerIdent on "Secure FTP Server"

and restart Proftpd using the following command

#/etc/init.d/proftpd restart

Creating The SSL Certificate For TLS

In order to use TLS, we must create an SSL certificate. I create it in /etc/proftpd/ssl, therefore I create that directory first:

If you use TLSRequired on, then only TLS connections are allowed (this locks out any users with old FTP clients that don't have TLS support); by commenting out that line or using TLSRequired off both TLS and non-TLS connections are allowed, depending on what the FTP client supports.

Restart ProFTPd using the following command

/etc/init.d/proftpd restart

That's it. You can now try to connect using your FTP client; however, you should configure your FTP client to use TLS (this is a must if you use TLSRequired on).

If you're having problems with TLS, you can take a look at the TLS log file /var/log/proftpd/tls.log.